What do I do if my email is hacked?

Losing access to your email account can feel overwhelming. Your email is often the gateway to banking, social media, work tools, and password resets. Whether you forgot your password, were locked out, or suspect hacking, this comprehensive guide explains how email account recovery works, what to do immediately, and how to prevent it from happening again, regardless of provider.

This guide is platform-agnostic, meaning the steps apply whether you use Gmail, Outlook, Yahoo, Proton, or another email service.

Why email account recovery is so important

Your email account is typically:

  • The recovery channel for other online accounts
  • The hub for password resets
  • A storage location for sensitive documents
  • Linked to financial services
  • Used for identity verification

If someone gains control of your email, they may attempt to reset passwords on other services. That’s why recovering and securing it quickly is critical.

Step 1: Identify the type of access issue

Before starting recovery, determine your situation:

1. You forgot your password

You still control your recovery email or phone number.

2. You're locked out after too many attempts

Security systems temporarily restricted access.

3. Recovery information was changed

Security systems temporarily restricted access.

4. Two-factor authentication (2FA) is blocking you

You lost your phone or authentication app.

5. The account appears compromised

Suspicious emails, login alerts, or password changes occurred.

Each scenario requires slightly different steps.

Step 2: Use the official recovery page

Always use the official login page of your email provider.

Avoid:

  • Links sent via email or text
  • Sponsored ads
  • Third-party “account recovery services”

Search directly for:

“[Provider Name] account recovery”

Or navigate manually to the provider’s main website.

Step 3: Start the password reset process

Most providers follow a similar flow:

  1. Click Forgot password

  1. Enter your email address

  1. Choose a recovery method:

    • Recovery email
    • SMS code
    • Authentication app
    • Security questions

If you still have access to your recovery method, this is usually the fastest resolution.

Step 4: If recovery info was changed

If a hacker changed your recovery email or phone number:

  • Check your inbox for a “security alert” about changes.
  • Many providers include a link allowing you to reverse recent changes.
  • Act immediately! These reversal links often expire quickly.

If that fails:

  • Use the provider’s identity verification process.
  • Be prepared to answer questions about:
    • Account creation date (approximate is fine)
    • Frequently contacted email addresses
    • Folder names you’ve created
    • Subject lines of recent emails

The more consistent your answers, the higher your recovery success rate.

Step 5: Recovering access without recovery methods

If you’ve lost access to both your recovery email and phone:

Most providers offer identity verification steps such as:

  • Uploading a government ID
  • Answering advanced account activity questions
  • Confirming recent login locations
  • Verifying device history

Tips to improve approval chances:

  • Attempt recovery from a familiar device
  • Use your usual IP address/location
  • Don’t guess wildly at answers
  • Be consistent

Multiple incorrect attempts can delay access further.

Step 6: After you regain access, you must secure immediately

Once you recover your email, take these steps immediately:

1. Change your password

  • Use at least 12–16 characters
  • Combine uppercase, lowercase, numbers, symbols
  • Do not reuse old passwords

2. Enable two-factor authentication (2FA)

  • Authentication app (strongest)
  • Hardware key (best option if available)
  • SMS (better than nothing)

3. Review account settings

Check for:

  • Unknown recovery email addresses
  • Forwarding rules
  • Email filters that auto-delete messages
  • Linked devices
  • App passwords

Hackers often leave backdoors.

4. Check login activity

Most providers show:

  • Recent login devices
  • IP locations
  • Suspicious activity alerts

Log out of unfamiliar sessions.

Step 7: Check other accounts immediately

If your email was compromised, assume risk elsewhere.

Reset passwords for:

  • Banking apps
  • Social media
  • Cloud storage
  • Shopping accounts
  • Password managers (if applicable)

Enable 2FA everywhere possible.

Common email recovery problems (and solutions)

"Too many attempts" error

Wait 24 hours and try again from a known device.

"We can't verify it's you"

Try:

  • From your home Wi-Fi
  • Using the device you normally use
  • At a time of day you typically log in

No recovery options available

You may need to:

  • Submit identity documentation
  • Contact support directly
  • Create a new account if recovery fails

How to prevent future email lockouts

Use a password manager

  • Generates strong passwords
  • Stores recovery codes safely

Keep recovery info updated

  • Maintain a current recovery phone number
  • Add a backup recovery email

Save backup codes

If using 2FA, download and store recovery codes offline.

Avoid phishing links

  • Check sender addresses carefully 
  • Hover over links before clicking
  • Never enter credentials from suspicious emails

Use separate emails for critical accounts

Consider:

  • One email for banking
  • One for social media
  • One for shopping

This limits exposure if one account is compromised.

Final thoughts

Email account recovery can feel stressful, but most users successfully regain access when they act quickly and follow official recovery steps.

The key principles are:

  • Move fast
  • Use official recovery pages
  • Secure everything immediately after
  • Strengthen your protection going forward

This situation is significantly improved when using MySudo since it is designed to reduce reliance on a single, permanent email identity. Instead of using one primary email inbox across banking, social media, shopping, and account recovery, a user can create separate, compartmentalized email identities for different purposes. If one address is compromised, the exposure is contained to that specific “Sudo,” preventing attackers from pivoting into other critical accounts. By minimizing the impact from a breach, MySudo turns identity protection from reactive recovery into proactive risk containment.